==============================================================================
Notepad++ version 5.7 <= Insecure DLL Hijacking Vulnerability (scilexer.dll)
==============================================================================
1. OVERVIEW
The Notepad++ application is vulnerable to Insecure DLL Hijacking Vulnerability. Similar terms that describe this vulnerability
have been come up with Remote Binary Planting, Unsafe Library Loading, and Insecure DLL Loading/Injection/Hijacking/Preloading.
2. PRODUCT DESCRIPTION
Based on the powerful editing component Scintilla, Notepad++ is the most powerful and famous open-source text editor written in C++
and uses pure Win32 API and STL which ensures a higher execution speed and smaller program size. By optimizing as many routines as
possible without losing user friendliness, Notepad++ is trying to reduce the world carbon dioxide emissions. When using less
CPU power, the PC can throttle down and reduce power consumption, resulting in a greener environment.
3. VULNERABILITY DESCRIPTION
The Notepad++ application passes an insufficiently qualified path in loading an external library, "scilexer.dll" when a user opens its associated file
with extensions - css, inc, inf, ini, log, scp, wtx, shtml . This vulnerability depends on the following situations -
- Notepad++ must have been made as the default text editor (so called users' most favorite "Notepad" replacement)
- Affected extensions must not have been registered with other applications
4. VERSIONS AFFECTED
5.7 and lower
5. PROOF-OF-CONCEPT/EXPLOIT
http://core.yehg.net/lab/pr0js/advisories/dll_hijacking/notepad++/poc/movie/
http://core.yehg.net/lab/pr0js/advisories/dll_hijacking/notepad++/poc/notepad++.exe_shtml_scilexer.dll.zip
Tested Platform:
OS: Windows XP Service Pack 3 (Fresh Windows Copy)
6. IMPACT
Attackers can trigger a successful exploit against a victim user in a number of ways such as placing a malicious external
library file made as hidden attribute and a seemingly interesting file in network shares, usb drives, file sharing networks,
social networks, ..etc
7. SOLUTION
Fixed version from the vendor has not been released yet.
However, it is suggested that the following workarounds be deployed by users to protect increasing mass exploitation of this
vulnerability class:
- Disable loading of libraries from WebDAV and remote network shares
- Disable the WebClient service
Please see workaround solution links in References section.
8. VENDOR
Notepad++ Developers Team
http://notepad-plus-plus.org/
9. CREDIT
This vulnerability was discovered by Aung Khant, http://yehg.net, YGN Ethical Hacker Group, Myanmar.
10. DISCLOSURE TIME-LINE
08-28-2010: vulnerability discovered
08-28-2010: notified vendor
08-28-2010: vulnerability disclosed
11. REFERENCES
Original Advisory URL: http://core.yehg.net/lab/pr0js/advisories/dll_hijacking/[notepad++]_5.7_insecure_dll_hijacking
Workaround Solution: http://support.microsoft.com/kb/2264107
Workaround Solution: https://www.microsoft.com/technet/security/advisory/2269637.mspx#EGF
Developer Solution: http://msdn.microsoft.com/en-us/library/ff919712%28v=VS.85%29.aspx
Unofficial DLL Hijacking List: http://www.corelan.be:8800/index.php/2010/08/25/dll-hijacking-kb-2269637-the-unofficial-list/
#yehg [08-28-2010]